This decorator doesn't look like it'll do quite what it says, and that's mostly my fault. This is part of what I need to do a permissions overhaul.

The `is_admin` attribute is on `request`, not on `request.user`, and also, it's True for teacher accounts on the distributed server. I think what you want is just:
`if request.user.is_superuser:`
(you wouldn't need the `getattr` since even non-logged-in Django users are instances of `AnonymousUser`, which has `is_superuser = False`)

Also, I don't think you need the `is_ajax`, below, with your new, magic, spiffy, DRY, 403 catching, right? Just an `if`/`else`.